allow uploads only to authenticated users (nginx + upload_module)

Solution 1:

You could use nginx's auth_basic, auth_request, or any other authentication method to wrap the /upload location.